EU wants Booking.com to check out of its scam problem

The European Commission has opened an investigation under the Digital Services Act into whether Booking.com is doing enough to stop fraudsters running scams, phishing and smishing on its platform.

Officials told The Register the probe, which opened Wednesday, covers a very large online platform (one with more than 45 million EU users) and has three strands.

The first is whether Booking.com is failing to prevent fraudulent and non-compliant listings. "This is very much about people portraying themselves as the owner of premises and putting it up for rent while they are not the real owner," an EC spokesperson said.

The second is whether it does enough to counter phishing and smishing (SMS phishing), and social engineering. "Scammers take over the account of a property owner and… portray themselves as the property owner, but also take over the contact details," she said. "So they start sending messages that people need to pay additional amounts."

The Commission also suspects Booking.com is not sufficiently protecting the data of its consumers and business users.

The third strand is advertising transparency: whether the platform clearly distinguishes ads from organic results, and whether it is clear about boosted listings, where property owners pay for higher ranking.

Officials cited Booking.com's own admission in June 2024 of a 500-900 percent jump in travel scams over the previous 18 months. "What made us concerned is the very high figures," an official said.

In the Netherlands alone, more than 1,000 fraud notifications were made in the first part of 2026, causing damage of €82,000, a tenfold increase on the previous year. “This is a real problem, and this is only the Dutch element,” the official said. “We have reports like that almost from all member states… So, we have clear elements where we find that the risk assessment was not sufficient, and as you know, the risk assessment is a key tool for us.”

The Commission acknowledges that Booking.com assesses fraud using cases on its own platform and external reports, and takes internal measures in response. But “we feel that what they have done is absolutely substandard,” the official said. “Although they take measures, they could go much further, and they could have much more solid systems to prevent fraud.”

“In the future we expect Booking.com to do a more diligent risk assessment,” she added. That could include addressing abuse of the reservation system, rapidly removing listings when fraud is reported, checking licenses, and changing how property owners are onboarded.

A spokesperson at Booking.com told The Register:

"We are cooperating fully with the European Commission and engaging constructively on its questions under the Digital Services Act (DSA). Security, trust and the protection of personal information are top priorities at Booking.com. We remain committed to working with relevant governments, regulators, law enforcement and industry partners to combat cybercrime and online fraud and protect travelers and partners." ®